JSON Formatter & Validator,
beautify, minify & debug.

JSON guide

JSON syntax rules, common mistakes, and best practices.

What is JSON?

JSON (JavaScript Object Notation) is a lightweight, language-independent data interchange format defined in ECMA-404 and RFC 8259. It was popularised by Douglas Crockford and has become the dominant format for REST APIs, configuration files, and data storage because it is both human-readable and trivially parseable by every programming language.

Despite its origins in JavaScript object literal syntax, JSON is not the same as JavaScript. JSON has stricter rules and a smaller feature set: no comments, no trailing commas, no undefined, no functions, no single-quoted strings, and no unquoted keys.

The six JSON data types

• String: A sequence of Unicode characters enclosed in double quotes. Control characters must be escaped with a backslash (\n, \t, \\, \"). Unicode escapes use \uXXXX format. Single quotes are not valid; the spec requires double quotes.
• Number: Integer or floating-point, with optional exponent notation (1.2e10). No leading zeros (except for the decimal fraction), no NaN, no Infinity. All JSON numbers are IEEE 754 double-precision; integers above 2⁵³ may lose precision in JavaScript environments.
• Boolean: Exactly true orfalse — lowercase, no quotes. True,FALSE, and "true" (quoted string) are all invalid.
• Null: Exactly null — lowercase. Represents the intentional absence of a value.
• Object: An unordered collection of key-value pairs enclosed in curly braces. Keys must be double-quoted strings. Values can be any JSON type. Pairs are separated by commas; no trailing comma is allowed after the last pair.
• Array: An ordered list of values enclosed in square brackets. Elements can be any JSON type. Elements are separated by commas; no trailing comma is allowed after the last element.

The most common JSON syntax errors

The JSON parser is unforgiving — a single misplaced character invalidates the entire document. These are the errors developers encounter most:

• Trailing commas: [1, 2, 3,] and{"a": 1, "b": 2,} are invalid JSON. JavaScript itself allows trailing commas in array and object literals, but JSON does not. Always remove the comma after the last element.
• Single-quoted strings: {'key': 'value'}is invalid. JSON requires double quotes for both keys and string values.
• Unquoted keys: {key: "value"}is JavaScript syntax, not JSON. All object keys must be quoted:{"key": "value"}.
• Comments: JSON does not support comments of any kind. Neither // comment nor /* comment */ are valid. If you need comments, consider JSONC (JSON with Comments, used by VS Code) or YAML.
• Undefined and function values: undefined,NaN, Infinity, and function expressions are not valid JSON values. JSON.stringify silently omits object properties with undefined values and throws on BigInt.
• Missing commas between items: ["a" "b"]is invalid. Every item in an array and every property in an object must be separated by a comma.

Beautify vs minify: when to use each

Beautified / formatted JSON uses indentation and line breaks to make the structure immediately readable. Use it when reviewing API responses in development, debugging data structures, writing JSON configuration files that will be edited by humans, or documenting an API schema.

Minified JSON removes all insignificant whitespace to produce the shortest valid JSON string. Use it for production API responses where bandwidth matters, localStorage payloads, or anywhere the JSON will be machine-read only. Minification typically reduces JSON size by 15–40% depending on the depth and key name lengths.

JSON and security: common pitfalls

JSON itself is a data format — it cannot execute code. However, several security issues arise at the boundaries where JSON meets application code:

• JSON injection: If you construct a JSON string by concatenating user input instead of using JSON.stringify, an attacker can break out of the expected value and inject arbitrary JSON structure. Always use the standard serialiser.
• eval() parsing: Never parse JSON with eval(). A malicious JSON payload crafted to contain JavaScript will execute arbitrary code. Use JSON.parse() which is safe.
• Large numbers: JSON numbers are stored as IEEE 754 doubles. Integers larger than 2⁵³ (Number.MAX_SAFE_INTEGER) lose precision. Use strings for IDs and large numeric values where precision is critical, or use a BigInt-aware JSON library.
• Prototype pollution: Parsing attacker-controlled JSON that contains __proto__ or constructor keys can modify JavaScript prototype chains if the parsed object is later merged with other objects carelessly. Use Object.create(null)or validate/sanitise parsed JSON from untrusted sources.

JSON alternatives and when to use them

• YAML: More human-readable, supports comments, multiline strings, and anchors. Preferred for configuration files (Docker, Kubernetes, GitHub Actions). Stricter parsing requirements — tab vs space errors can break documents silently.
• TOML: Configuration-focused, very readable for flat key-value structures. Used by Rust's Cargo.toml, Python'spyproject.toml, and Hugo.
• MessagePack / CBOR / Protobuf: Binary serialisation formats with significantly smaller payloads and faster parsing than JSON. Used where performance and bandwidth are critical.
• JSON5: A JSON superset that allows comments, trailing commas, single-quoted strings, and more. Not standard — requires a non-native parser. Used in some build tools and config files.